Spoofing: One Identity Shared by Multiple Vessels

The satellite-based Automatic Identification System (AIS) that we use for tracking vessels is a radio transmission system in which a ship sends a coded message that can be picked up by satellite and land-based receivers. The code includes information about a vessel’s identity such as its name, ship type, size and call sign. The messages also include a nine-digit Maritime Mobile Service Identity (MMSI) that is supposed to be unique to each vessel.

Each operator has to manually enter their AIS message into their transponder, which leaves a lot of room for errors—intentional or accidental. We’ve seen arbitrary codes that make no sense, and codes that are too incomplete to provide much useful information about a vessel’s identity.

Certain errors in the MMSI code are more frequent than others, such as when an operator inputs a simple, meaningless sequence such as 123456789, or when the MMSI contains just the first three digits (representing the country of origin) followed by all zeros. We’ve seen many Chinese vessels using this practice, broadcasting the MMSI 412000000.

This means that all throughout the oceans, multiple vessels are simultaneously broadcasting the same MMSI number, making them indistinguishable from one another without closer inspection. We call this spoofing.

Identifying their tracks is tough, because rather than showing up as separate vessels, they appear as one vessel with a track that jumps back and forth across the ocean at impossible speeds.

Two Vessels using the same MMSI. Credit: ShipView
Credit: ShipView

The image above shows the position of hundreds of vessels on the water as various colored triangles. For this post, we’re interested in two vessels; one broadcasting its position from the Pacific Ocean and the other broadcasting from the Indian Ocean. Each has the same MMSI number encoded into its AIS broadcast: 416002232. If we try to generate a track by plotting MMSI signals in sequence based on the time they’re broadcast, it would appear as one vessel bouncing between two locations that are oceans apart. This is indicated here in dashed black lines crisscrossing the map. (We’ve separated and labeled their true tracks here as 1st track and 2nd track)

The image below shows the same thing with the other vessel tracks removed. Here the large image reveals their two distinct tracks and the inset shows their AIS signals apparently jumping from the Indian Ocean to coastal New Guinea.

Spoofing

To separate two vessels broadcasting the same identity, we look at all of the AIS messages reporting a given MMSI over a specific time period. Signals from positions that would require an unreasonable speed for a vessel to traverse are considered unrelated, and positions that are physically possible are grouped together into a coherent track. In the examples above, our algorithm would recognize that the signals on the left cannot possibly be from the same vessel as the signals on the right half way around the world. The computer knows to split these tracks.

The process of parsing tracks from this type of multiple identity is pretty straightforward. It gets messy when we look at a group of vessels all using the same MMSI in close proximity to one another. For this task, our analysts and programmers have had to fine tune the algorithm to assemble strings of AIS broadcasts that belong together out of a messier set of signals.

It’s a matter of matching logical times and distances between broadcasts, and then discarding signals that don’t fit into that scheme. With the right balance between time and distance, we can say with some confidence that a given sequence of signals constitutes a valid segment of track.

Under normal circumstances, a segment may be comprised of long strings of signals that stretch over hours or days, and segments can be stitched together to create a long, continuous track. In some case of duplicate MMSIs, however, we end up with short, choppy segments that can’t be strung together.

Nonetheless, even a relatively short segment can give us useful information when it reveals a pattern of movement consistent with fishing behavior. While we can’t say who or what is out there, we may be able to say there’s fishing going on. That information is useful for understanding the amount of fishing happening in the ocean and where it’s occurring.

Instances of spoofing represent less than a quarter of one percent of the AIS signals we receive. Certainly not all spoofing represents illegal or undesirable activity, but it is unquestionably one method illegal fishers use to conceal their identity and their behavior.

Scroll to Top